What is Business Continuity Management?

By Brenda Brown-Paul

Business Continuity Management, Continuity of Operations (COOP), and Continuity of Government (COG) are essential planning methodologies that help keep operations flowing during and after a disaster. Please note that COOP and COG are separate areas, and I will discuss that in a future article. Regardless of the plan, the link to external providers, including emergency management personnel, is crucial.

In my consultancy, I emphasize the importance of business continuity and resilience management for small companies. These areas are crucial for organizations to maintain stability and adapt to changing environments. As the EMN Policy Group wrote in “The Psychology of Unpreparedness,” it is dangerous to assume nothing will happen because nothing has happened so far. According to the Federal Emergency Management Agency (FEMA), more than 40% of businesses never reopen after a disaster, and for those that do, only 29% are still operating after two years. Several factors contribute to these failures, including low cash reserves, inadequate insurance, and limited access to emergency capital. One of the factors included is the lack of a business continuity management program.

Some industries require a continuity plan. Some insurance companies will ask to see your plan without offering a rate reduction! Regardless of the company’s size, even for solopreneurs, it is essential to have a business continuity plan to follow the established planning lifecycle. This is not difficult if integrated into how a company approaches its day-to-day operations.

BCM Lifecycle

1. Risk assessment and mitigation: Identify potential risks and vulnerabilities that could disrupt business operations. Develop strategies to mitigate these risks and ensure that the organization can continue to function effectively in the face of unexpected events.

2. Strategy and methodology: What are the goals regarding risk mitigation and recovery? Most importantly: Has senior management bought into the need for a resilience and recovery plan? Define who will be managing the Business Continuity Program. Will this be a team or a single person? What department will ‘own’ the program? What are the company’s impact thresholds? Generally, this includes an unacceptable financial impact, a negative impact on customer service, an unfavorable reputation, supply chain delays, and other impacts relevant to the service or delivery.

3. Business Impact Analysis: Assess the potential impact of various disruptions on the organization. This impact analysis will define the organization's critical functions and processes. In this phase, the business unit will set a really important number—the Maximum Tolerable Disruption. How long can the organization function without a particular function or staff member? Five days? Ten minutes? This analysis will help prioritize recovery efforts and allocate resources effectively during a crisis.

4. Plan Development: Here is where all the writing happens. Develop and implement recovery strategies to restore critical business functions as quickly as possible following a disruption. This may involve creating redundant systems, establishing alternative work sites, or developing backup plans for key personnel to ensure resiliency. The BCM strategy is approved by management, and a template for the Business Resilience Plans is created. Each business unit should develop its own plan and reference written procedures that enable contingency personnel to run the organization's critical functions. Standard Operating Procedures are key to a resilient organization.

The company will also create a Crisis Management Plan and perhaps a Pandemic Plan. The IT department will create an IT Disaster Recovery Plan and a Data Breach Plan. The company’s Crisis Management Plan includes interactions with Emergency Management personnel in your local area. Make the connections that you think you will need before a crisis occurs. Ask the EM heads in your area what services they provide, what you can expect from them, and what they need from you to make your organization safer.

5. Training and Awareness: Provide ongoing training and awareness programs to ensure employees are familiar with the organization's business continuity and resiliency plans. This will help them respond effectively during disruption and minimize the impact on the organization.

6. Exercises and Testing: The management team should hold a tabletop exercise of the BCM plan annually at a minimum. Most auditors require that. However, planning tabletops and even simulation exercises throughout the year is better. Small drills reinforce safety plans, and tabletops and simulations enable your teams to identify any gaps or adjustments needed.

7. Continuous Improvement (Do It Again!): Regularly review and update the organization's business continuity and resiliency plans to remain relevant and practical. This should involve conducting regular tests and exercises to identify areas for improvement and incorporate lessons learned from real-world events. Also, the risk management plan should be regularly reviewed, especially when there are changes to locations, IT upgrades, network architecture, and the operational environment. Finally, the entire program and plans should be reviewed annually to ensure that everything is up to date.

There are also a few other things to consider. Foster a culture of open communication and collaboration within the organization. This will help ensure that all stakeholders are aware of their roles and responsibilities in the event of disruption, enabling them to work together effectively to address any challenges.

Develop a structured approach to managing organizational processes, systems, and personnel changes. This will help ensure that changes are implemented smoothly and effectively, minimizing disruption and maximizing the benefits of the change. Change the BCM plans accordingly. If necessary, notify the local EM of changes relevant to recovery activities.

Speaking of EM, I cannot overemphasize the importance of the company communicating with local and industry Emergency Management (see “We Collaborate” in EMN). Engage with critical service providers, including clients, suppliers, and regulators, to ensure they know the organization's business continuity and resiliency plans and can support the organization during a disruption.

By focusing on these areas, you will be well-positioned to help your company maintain business continuity and resilience in the face of unexpected events and successfully navigate operational changes.